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Central Intelligence Agency Annual Privacy Act 
Report, Part II and Part III, for 1976 


m l3 } accor dance with 0MB Circular No. A-108, Transmittal 
Memorandum No. 2, and 0MB Memorandum of 13 January 1977 forwarded 
herewith are Parts II and III of the Annual Privacy Act ’ R ep™? for 
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John F. Blake 
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PART II. ACTIONS TO COMPLY WITH THE ACT 

1. All major initiatives to comply with the Privacy Act 
were taken in 1975. In 1976, as experience was gained, procedure 
were refined and expanded in an effort to bring all Agency 
components and personnel to a fuller realization of the Act's 
implications, and to work in conjunction with the Act. 

2. Agency personnel at all levels have been provided with 
information explaining the Act and its effects. Innumerable 
briefings have been held and Agency speakers have addressed 
participants in training courses whenever possible. In addition, 
an Agency handbook is soon to be published to assist components 
and personnel in the implementation of the Act's requirements. 

In the fall, a symposium was held which drew together officials 
of various offices to discuss their particular problems and to 
reach a consensus on the processing of, and uniformity in 
responding to requests pursuant to the Act. Many officers have 
attended courses sponsored by agencies such as the Civil Service 
Commission . 

3. Components of the Agency have attempted to review 
their record holdings to ensure that the information they have 
conforms with pertinent statutes and Executive orders . The 
thrust of the current effort is to collect only that information 
which is needed, and eliminate nonessential information prior 

to its insertion into a records system. Also, office directives 
have been issued to restrict holdings of personal information 
to that xtfhich is essential to the functions of a particular 
office . 

4. Historically, the Agency's basic premise for the hand- 
ling of information has been on a strict and clearly established 
need-to-know principle. Access to, and the protection of 
records, many of which are classified, is tightly controlled 
and the information is stored in locked combination safes or 
vaulted areas. Little in the way of procedural change has 

been needed to protect these records. 

5. Assuring the accuracy of records is a constant 
objective of the Agency. Where possible, periodic reviews are 
conducted by Agency components , and information is obtained 
directly from the individual concerned. Where conflicting 
information is received, efforts are made to correct any 
deficiencies. However, given the lack of available resources, 
there is no systematic program to review records systems. 
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Therefore, corrections to records must normally await a request 
from an individual to review his or her records. 

6. Records systems are totally maintained by Agency 
personnel. No contracts for this function are let. 

7. Where Social Security Account Numbers (SSAN) 

were previously obtained as a matter of course, this practice 
has ceased. All forms are reviewed for the necessity of inclu- 
ding the SSAN and a clear explanation is provided to an individual 
as to whether the number is required, and the authority cited 
if applicable. 

PART III. EFFECTS OF THE ACT 

With approximately one and one half years' experience 
in implementing the Privacy Act, it is still difficult to ascertain 
the specific effects of the Act on the Agency and its assigned 
functions. One thing is becoming rather evident, however, in 
that the policy of the Government in providing information to 
the general public through the Privacy Act, the Freedom of Infor- 
mation Act, et al., is causing real concern within certain 
quarters of the Agency. The impact of this policy is developed 
further in the following topics for discussion. 

1 . Reductions in the Collection of Personal Information 

All systems of records are maintained pursuant to appro- 
priate statutes and Executive orders. In addition to the comments 
in paragraph 8 to follow, the Agency is currently preparing 
a notice to the Federal Register announcing an additional merger 
of two systems of records into one; also, there are active 
surveys underway for further similar mergers. However, the 
Agency had to contend with two factors that were causing a 
significant increase in our record holdings . The CIA was 
subject to a Congressional moratorium not to destroy any , 

records; currently, Congress can opt to review records before 
destruction. Also, approvals from the National Archives and 
Records Service for many of the Agency's Records Control 
Schedules remain pending. These factors are not to the exclusion 
of each other, so both must be resolved. A significant number 
of systems are affected. Many records, literally hundreds of 
thousands, have been selected for destruction. At present, 
these records serve only as fodder for Privacy Act and similar 
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type requests. Once favorable decisions are rendered, the 
records will be destroyed. 

2 . Obtaining Information from Individuals 

There would appear to be little effect caused by the 
Privacy Act on individuals providing information on themselves. 
However, when derogatory information is provided on a third 
party, informants tend to request confidentiality. This trend 
also appears to be much stronger in the Washington, D.C., area. 
Given the general legal framework wherein the U.S. Government 
must provide information pursuant to the Privacy Act et al., 
serious concerns have developed among some sources that have 
provided intelligence information in the past. To them, there 
is a real question as to whether their identities can be protected 
by the Agency. The quality and quantity of information being 
provided by these sources has diminished; some sources have 
refused further cooperation with the Agency due to the threat 
of exposure. The extent to which the Privacy Act contributes 
to this diminishing effect cannot be gauged; although, even with 
the Act’s exemption provisions, it would have to be considered 
an influential factor, justified or not. 

3 . Obtaining Information from Other Agencies 

Effective cooperation between the Agency and other 
departments is the general norm in responding to requests for 
information. Because another agency maintains a log of queries 
for personal information, it has been necessary in some cases 
to discontinue these queries where they deal with covert or 
confidential relationships; to do otherwise might invite 
a breach of operational security. 

4 . Disclosing Information 

The Agency viexcs the disclosure of information from 
three sides. * 


A. Obtaining Agency employees’ signed releases for 
the transfer of personal information has caused no major 
unsolved problems. It has increased the workload, however, 
and caused delays in the processing of employees for 
outside activities. 

B. The Freedom of Information Act often requires the 
release of personal information records of prominent 
individuals where written consent has not been provided. 

The determination made by the Agency is that if the 
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information is already in the public domain, such records 
could be released. As one could expect, there is a thin 
line between releasing information required under FOIA and 
protecting information under the Privacy Act. The 
Agency has also experienced considerable difficulty with 
regard to personal records where the individual is 
deceased. Since deceased persons are not protected by 
the Privacy Act, this often requires the Agency to make 
a difficult judgment as to whether the privacy of relatives 
would be involved. 

C. Although this may apply to FOIA more than the 
Privacy Act, there is serious concern that repeated dis- 
closure of seemingly innocuous bits of information can 
in the long run enable close students of the material to 
discern information patterns which would identify intelli- 
gence sources or the methods of gathering intelligence. 
First, there is the danger that disclosure will imperil in- 
telligence sources and methods, by revealing the identity of 
particular sources, by dampening liaison with friendly 
services, by discouraging recruitment, or by facilitating 
countermeasures by target intelligence services. Second, 
there is the concern that disclosure of intelligence 
operations or assessments against friendly foreign nations 
will embarrass their governments and generate hostile 
public opinion amongst their people. Although the 
benefits of providing the public with access to a multitude 
of records maintained by an intelligence organization 
are recognized, it may still be too early to determine 
the true cost of damaging disclosure. 

5 . Individual Access to Agency Records 

A. The awareness by the general public of the existence 
of the Privacy Act, as such, increased only slightly. 

The large majority of requesters still ask for information 
on themselves by citing the Freedom of Information Act 
or both Acts. As stated in the previous report, most 
requesters must be asked to provide additional personal 
identifying data. Rarely does a requester cite specific 
records systems to be searched. We quickly acknowledge 
all queries for information; however, the time necessary 
to provide a final response is considerable, especially 
if significant documentation is produced. It is common 
that a record in one component will contain information 
provided by another component or another agency, and 
all interests must be considered. 

B. A summary of Privacy Act requests processed, 
appeals generated therefrom, and the disposition of these 
cases is provided here\vith: 
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1 . Requests : 


Carried over from 1975 356 

Received in 1976 2356 

Total available during 1976 .. 2712 

Final responses 2114 

Granted in full 154 

Granted in part 404 

Denied 56 

Cancelled, withdrawn or no 

records maintained 1500 

Carried over to 1977 598 

2. Appeals: 

Carried over from 1975 0 

Received 78 

Total available during 1976 78 

Final responses,.... 12 

Granted in full 0 

Granted in part 5 

Denied 6 

Cancelled or withdrawn 1 

Carried over to 1977. 66 


C. In addition to the above requests, which should 
be considered as formal requests to the Agency , an informal 
mechanism was utilized by the Agency to provide responses 
to Agency employees wishing to review their records. The 
program was successful and is being maintained as a 
continuing service. It is estimated that more than fourteen 
hundred requests were received from employees. 

6 . Sale or Rental of Mailing Lists 

Mailing lists are not provided, rented or sold by the 
Agency. 

7 . Use of Social Security Account Numbers as a Personal 
Identifier 

There were no new systems of records which used the SSAN 
as a personal identifier during this reporting period. However, 
CIA system #29, Manpower Control System, added to its- method 
of "Retrievability" the SSAN. There seems to be, also, a 
general awareness on the part of individuals that a SSAN 
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need not necessarily be provided, 
its use. 


and they will question 


8 . 


Zj j . ! 3 li£_ 5 ' cru ti ny of Agency Recordkeeping Practices 


1976 » the Agency published in the Federal Register 

notice of two new records systems, the merger oF" three' sTs fems 

weJe ?ecei?Sd ln £?■ ad, ? itional thirteen. No comments' 

were received from the public m response to these notices. 
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